2

So I came across an interesting error today. I've got a SharePoint 2010 server setup and running a few web applications. Each of these web applications are configured with their own app pools and services accounts. They were set up months ago, and have been running fine.

Today, I'm trying to set up a couple new web applications with new app pools and services accounts for them. When I try to open sites associated with them, I get a 503 - Service Unavailable error. Tracing it down, I believe it's related to this: http://blog.markhaverty.com/2010/10/20/service-unavailable--http-erro.aspx. There is an existing GPO in place that is replacing the log on at batch permissions, setting it to only be 1 particular service account that is not any of my SharePoint service accounts.

I'll be talking with my AD guy about how we can fix this, but in the mean time, I'm curious as to why my existing sites are working right now. What I'm reading says that they should be failing with the same error.

Anyone have any thoughts why?

Improve this question
6
  • and you are sure your service account password havent expired? The error message looks similar to the one i got when a service account expired
    – Anders Rask
    Commented May 5, 2011 at 16:36
  • @Evan M. have you tried reseting your server/IIS. If GP has removed IIS_WPG from logon as batch job your sites will stop after restart.
    – Toni Frankola
    Commented May 5, 2011 at 17:11
  • @Anders: Talked with the AD admin, and we put a deny on for my SP server for the GPO, and everything worked fine. @Toni: That could be it. The GPO has been in place since the server was brought online ~8 months ago, but the server was put in an affected OU a couple months ago. Quite possible the server hasn't been reset in that time, though I would have expected the daily App Pool recycles to trigger it as well.
    – Evan M.
    Commented May 5, 2011 at 19:03
  • Did you find a solution to this problem or have any more information you can add to the question?
    – Alex Angas
    Commented May 17, 2011 at 2:06
  • Nothing more to add. Things work fine now that I disabled the GPO for my SharePoint machine. Thinking about it a little further, Toni's explanation makes the most sense. An App Pool recycle wouldn't be enough to adjust the account permissions, as the account's permissions ticket wouldn't change. The full system reset would be the only thing that could reset things.
    – Evan M.
    Commented May 17, 2011 at 14:07

1 Answer 1

Reset to default
2

The server was previously moved from one OU to another, picking up the GPO policy that sets the log on as batch permissions, but wasn't restarted afterwards or since. The user accounts that were running the previous Web Applications maintained their permissions, and it was only the new user accounts that were blocked. Removed the GPO restrictions, and everything worked fine.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.